33 ms·
Back when I was a stupid kid, I once did ln -s /dev/zero index.html on my home page as a joke. Browsers at the time didn’t like that, they basically froze
by layer8 2y ago
Back when I was a stupid kid, I once did
ln -s /dev/zero index.html
on my home page as a joke. Browsers at the time didn’t like that, they basically froze, sometimes taking the client system down with them.
Later on, browsers started to check for actual content I think, and would abort such requests.
- artursapek 2y ago[flagged]
- koolba 2y agoI hope you weren’t paying for bandwidth by the KiB.
- santoshalper 2y agoNah, back then we paid for bandwidth by the kb.
- slicktux 2y agoThat’s even worse! :)
- sandworm101 2y agoDevide by zero happens to everyone eventually. https://medium.com/@bishr_tabbaa/when-smart-ships-divide-by-zer0-uss-yorktown-4e53837f75b2 https://medium.com/@bishr_tabbaa/when-smart-ships-divide-by-... "On 21 September 1997, the USS Yorktown halted for almost three hours during training maneuvers off the coast of Cape Charles, Virginia due to a divide-by-zero error in a database application that propagated throughout the ship’s control systems." " technician tried to digitally calibrate and reset the fuel valve by entering a 0 value for one of the valve’s component properties into the SMCS Remote Database Manager (RDM)"
- astolarz 2y agoBad bot
- fuzztester 2y agoI remember reading about that some years ago. It involved Windows NT. https://www.google.com/search?q=windows+nt+bug+affects+ship https://www.google.com/search?q=windows+nt+bug+affects+ship
- m463 2y agoSounds like the favicon.ico that would crash the browser. I think this was it: https://freedomhacker.net/annoying-favicon-crash-bug-firefox-chrome-safari-browsers-4316/ https://freedomhacker.net/annoying-favicon-crash-bug-firefox...
- dolmen 2y agoLooks like something I should add for my web APIs which are to be queried only by clients aware of the API specification.
- bobmcnamara 2y agoI made a 64kx64k JPEG once by feeding the encoder the same line of macro blocks until it produce the entire image. Years later I was finally able to open it.
- opan 2y agoI had a ton of trouble opening a 10MB or so png a few weeks back. It was stitched together screenshots forming a map of some areas in a game, so it was quite large. Some stuff refused to open it at all as if the file was invalid, some would hang for minutes, some opened blurry. My first semi-success was Fossify Gallery on my phone from F-Droid. If I let it chug a bit, it'd show a blurry image, a while longer it'd focus. Then I'd try to zoom or pan and it'd blur for ages again. I guess it was aggressively lazy-loading. What worked in the end was GIMP. I had the thought that the image was probably made in an editor, so surely an editor could open it. The catch is that it took like 8GB of RAM, but then I could see clearly, zoom, and pan all I wanted. It made me wonder why there's not an image viewer that's just the viewer part of GIMP or something. Among things that didn't work were qutebrowser, icecat, nsxiv, feh, imv, mpv. I did worry at first the file was corrupt, I was redownloading it, comparing hashes with a friend, etc. Makes for an interesting benchmark, I guess. For others curious, here's the file: https://0x0.st/82Ap.png https://0x0.st/82Ap.png I'd say just curl/wget it, don't expect it to load in a browser.
- arc-in-space 2y agoOh hey it's the thing that ruins an otherwise okay rhythm game.
- IamDaedalus 2y agoon mobile Brave just displayed it as the placeholder broken link image but in Firefox it loaded in about 10s
- Scaevolus 2y agoThat's a 36,000x20,000 PNG, 720 megapixels. Many decoders explicitly limit the maximum image area they'll handle, under the reasonable assumption that it will exceed available RAM and take too long, and assume the file was crafted maliciously or by mistake.
- M95D 2y agoI wonder if I could create a 500TB html file with proper headers on a squashfs, an endless <div><div><div>... with no closing tags, and if I could instruct the server to not report file size before download. Any ideeas?
- CobrastanJorji 2y agoYes, servers can respond without specifying the size by using chunked encoding. And you can do the rest with a custom web server that just handles request by returning "<div>" in a loop. I have no idea if browsers are vulnerable to such a thing.
- M95D 2y agoI would make it an invisible link from the main page (hidden behind a logo or something). Users won't click it, but bots will.
- stefs 2y agothe problem with this is that for a tarpit, you just don't want to make it expensive for bots, you also want to make it cheap for yourself. this isn't cheap for you. a zip bomb is.
- ku1ik 2y agoRight, so an invisible link + a zipbomb is da bomb.
- stefs 2y agomaybe, maybe not. it's one tool at your disposal. it's easy to guard against zip bombs if you know about them - the question is, how thorough are the bot devs you're targeting? there are other techniques. for example: hold a connection open and only push out a few bytes every few seconds - whether that's cheap for you or not depends on your servers concurrency model (if it's 1 OS thread per connection, then you'd DOS yourself with this - but with an evented model you should be good). if the bot analyzes images or pdfs you could try toxic files that exploit known weaknesses which lead to memory corruption to crash them; depends on the bots capabilities and used libraries of course.
- AStonesThrow 2y agoWait, you set up a symlink? I am not sure how that could’ve worked. Unless the real /dev tree was exposed to your webserver’s chroot environment, this would’ve given nothing special except “file not found”. The whole point of chroot for a webserver was to shield clients from accessing special files like that!
- vidarh 2y agoYou yourself explain how it could've worked: Plenty of webservers are or were not chroot'ed.
- pandemic_region 2y agoWhich means that if your bot is getting slammed by this, you can assume it's not chrooted and hence a more likely target for attack.
- vidarh 2y agoThis does not logically follow. If your bot is getting slammed by a page returning all zeros (what the person I replied to reacted to), all you know is something on the server is returning a neverending stream of zeros. A symlink to /dev/zero is an easy way of doing that, but knowing the server is serving up a neverending stream of zeros by no means tells you whether the server is running in a decently isolated environment or not. Even if you knew it was done with a symlink you don't know that - these days odds are it'd run in a container or vm, and so having access to /dev/zero means very little.
- M95D 2y agoCould server-side includes be used for a html bomb? Write an ordinary static html page and fill a <p> with infinite random data using <!--#include file="/dev/random"-->. or would that crash the server?
- GTP 2y agoI guess it depends on the server's implementation. but, since you need some logic to decide when to serve the html bomb anyway, I don't see why you would prefer this solution. Just use whatever script you're using to detect the bots to serve the bomb.
- amelius 2y agoMaybe it's time for a /dev/zipbomb device.
- GTP 2y agoln -s /dev/urandom /dev/zipbomb && echo 'Boom!' Ok, not a real zip bomb, for that we would need a kernel module.
- ompogUe 2y agowe discovered back when IE3 came out that you could crash windows by leaving off a table closing tag.